The STIG MCP Server

2,029 DISA STIG hardening rules across 15 benchmarks - RHEL 8/9, Ubuntu 22.04 LTS, Windows 11, Windows Server 2022, and Cisco IOS/NX-OS/ISE - with real check and fix text, CCI mappings, and .ckl checklist export, searchable from your AI assistant. Free, no login.

Connect it

Claude Code

claude mcp add --transport http mactech-stig https://www.mactechsolutionsllc.com/api/mcp/stig

Any MCP client (JSON config)

{
  "mcpServers": {
    "mactech-stig": {
      "url": "https://www.mactechsolutionsllc.com/api/mcp/stig"
    }
  }
}

Air-gapped or GCC High

Hosted MCP servers - this one included - run in commercial cloud, so a CUI enclave or an air-gapped network cannot reach them. The offline build is the same STIG and CMMC corpus compiled into a single file: no install, no API key, and no network access at any point. It needs only Node 20.

curl -O https://www.mactechsolutionsllc.com/downloads/mactech-compliance-mcp.mjs
curl -O https://www.mactechsolutionsllc.com/downloads/mactech-compliance-mcp.mjs.sha256

# carry both across your boundary, then on the target host:
sha256sum -c mactech-compliance-mcp.mjs.sha256
claude mcp add --transport stdio mactech-compliance -- node ./mactech-compliance-mcp.mjs

Verify the checksum on arrival. Once the file is inside the enclave there is no route back out to re-download and compare, so a locally run hash against a separately carried value is the only integrity check available.

What it can do

search_stig

Keyword search across every benchmark - rule IDs and titles first, then descriptions - filterable by product, severity (CAT I/II/III), and SCAP automatability, with paging through the full match set.

“Which RHEL 9 CAT I rules cover SSH configuration?”

get_stig_rule

One rule in full: requirement discussion, the exact check procedure an assessor runs, the fix text, and the NIST control mapping.

“Give me the full check and fix for SV-257777.”

list_stig_benchmarks

Coverage map: every benchmark with its version, rule count, and severity breakdown.

“Is Windows Server 2022 covered, and at what STIG version?”

Frequently asked questions

What is the MacTech STIG MCP server?

A free Model Context Protocol server that gives AI assistants searchable access to DISA Security Technical Implementation Guide (STIG) rules: the requirement discussion, the exact check procedure, the fix text, severity category (CAT I/II/III), NIST control mapping, and whether the rule is SCAP-automatable.

Which STIG benchmarks are covered?

Fifteen benchmarks, 2,029 rules total: RHEL 8 (v2r5), RHEL 9 (v2r6), Ubuntu 22.04 LTS (v2r6), Windows 11 (v2r5), Windows Server 2022 (v2r6), Cisco IOS Router NDM (v3r5) and RTR (v3r4), Cisco IOS Switch NDM (v3r5), RTR (v3r2) and L2S (v3r1), Cisco NX-OS Switch NDM (v3r5), RTR (v3r3) and L2S (v3r2), and Cisco ISE NDM and NAC (v2r2). For technologies outside this set, DISA publishes the full STIG library at public.cyber.mil/stigs.

Why use this instead of asking the AI directly?

STIG rule IDs, check commands, and fix procedures are exactly the kind of detail language models garble from memory - a hallucinated registry path or sysctl key wastes an afternoon. This server returns the actual benchmark text, so the commands your assistant quotes are the real ones.

Does it require authentication or store anything?

No auth, free, stateless. We keep daily aggregate counts only (connections, tool names, client application names) - no payloads, no raw IPs, no user agents.

Also from MacTech: the CMMC / NIST 800-171 server and the Federal Market server. MacTech Solutions is an SDVOSB that hardens and certifies defense-contractor environments - talk to us.